-
-
Notifications
You must be signed in to change notification settings - Fork 4
/
archives.jenkins.io.tf
109 lines (94 loc) · 3.32 KB
/
archives.jenkins.io.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
resource "digitalocean_ssh_key" "archives_jenkins_io" {
name = "Administrator Public SSH Key for archives.jenkins.io"
public_key = file("ssh/id_archives_jenkins_io.pub")
}
resource "digitalocean_volume" "archives_jenkins_io_data" {
region = var.region
name = "archivesjenkinsiodata" # Only lowercase alphanum
size = 750
initial_filesystem_type = "ext4"
description = "Data disk for archives.jenkins.io"
}
resource "digitalocean_volume_attachment" "archives_jenkins_io_data" {
droplet_id = digitalocean_droplet.archives_jenkins_io.id
volume_id = digitalocean_volume.archives_jenkins_io_data.id
}
resource "digitalocean_droplet" "archives_jenkins_io" {
image = "ubuntu-22-04-x64"
name = "archives.jenkins.io"
region = var.region
size = "s-2vcpu-2gb"
monitoring = true
ipv6 = true
resize_disk = true
ssh_keys = [digitalocean_ssh_key.archives_jenkins_io.fingerprint]
user_data = templatefile("${path.root}/.shared-tools/terraform/cloudinit.tftpl", { hostname = "archives.do.jenkins.io" })
}
## Allow accessing the internet in HTTP/HTTPS/DNS and allow incoming HTTP/HTTP from anywhere (public service)
#trivy:ignore:AVD-DIG-0001 trivy:ignore:AVD-DIG-0003
resource "digitalocean_firewall" "archives_jenkins_io" {
name = "archives.jenkins.io"
droplet_ids = [digitalocean_droplet.archives_jenkins_io.id]
inbound_rule {
protocol = "tcp"
port_range = "22"
source_addresses = flatten(concat(
[for key, value in module.jenkins_infra_shared_data.admin_public_ips : value],
module.jenkins_infra_shared_data.outbound_ips["pkg.jenkins.io"],
module.jenkins_infra_shared_data.outbound_ips["trusted.ci.jenkins.io"],
))
}
inbound_rule {
protocol = "tcp"
port_range = "80"
source_addresses = ["0.0.0.0/0", "::/0"]
}
inbound_rule {
protocol = "tcp"
port_range = "443"
source_addresses = ["0.0.0.0/0", "::/0"]
}
outbound_rule {
protocol = "tcp"
port_range = "53"
destination_addresses = ["0.0.0.0/0", "::/0"]
}
outbound_rule {
protocol = "udp"
port_range = "53"
destination_addresses = ["0.0.0.0/0", "::/0"]
}
outbound_rule {
protocol = "tcp"
port_range = "80"
destination_addresses = ["0.0.0.0/0", "::/0"]
}
outbound_rule {
protocol = "tcp"
port_range = "443"
destination_addresses = ["0.0.0.0/0", "::/0"]
}
## Allow puppet protocol to puppet.jenkins.io
outbound_rule {
protocol = "tcp"
port_range = "8140"
destination_addresses = ["20.12.27.65/32"]
}
## Allow rsyncing to OSUOSL and pkg.jenkins.io
outbound_rule {
protocol = "tcp"
port_range = "873"
destination_addresses = flatten(concat(
module.jenkins_infra_shared_data.external_service_ips["ftp-osl.osuosl.org"],
module.jenkins_infra_shared_data.outbound_ips["pkg.jenkins.io"],
))
}
outbound_rule {
protocol = "tcp"
port_range = "22"
destination_addresses = flatten(concat(
module.jenkins_infra_shared_data.external_service_ips["ftp-osl.osuosl.org"],
module.jenkins_infra_shared_data.outbound_ips["pkg.jenkins.io"],
))
}
}